"Qubes OS comes from an elegant concept: if you can isolate functional components within disposable containers, and you can separate those components that can be tainted through their interaction with the outside world from the core subsystems, you stand a good chance to preserve the integrity and security of the base Operating System at the possible expense of needing to jump through some hoops to move data around the system. All in all it sounds like a good proposition if it can be demonstrated to be practical." Read the full review.

UAC was intentionally designed to be annoying, to raise awareness of apps running as administrative users without good reason and trigger a sort of roundabout kick in the pants to developers via annoyed users.

I absolutely agree though that the big issue will be putting the metaphors into a scheme that feels natural to use for the average user instead of feeling like it's fighting against the user.

If the features are compelling enough the performance hit will be overlooked, just like it has been in most of the big jumps in computing.